CS and medicine are different. In medicine people repeat work all the time; in ours you can't get repetitious work published. So there's no point in my publishing a paper about re-identifying NHS patients by postcode and date of birth after Latanya published her classic on
re-identifying US patients by date of birth and zip code. So even if their literature search had been thorough, the medical methodology of a meta-analysis is weak.

But the authors' search wasn't at all thorough. Much computer security work is published by Springer, not by the ACM and IEEE, or online as tech reports. So they only got one of Cynthia Dwork's papers, for example, and not the most important ones.

Finally, the claim that modern de-identification techniques are effective is not consistent with empirical observation. In the UK, the "pseudonymous" records used in research still have date of birth plus postcode. Yet it is to be expected that this article will be cited as an excuse by medical researchers who won't read the detail and will continue to operate systems that are both unsafe and unlawful.